Repository navigation
id: make the C2 NAT-emulation lab reproducible from the repo (de-hardcode paths, add a runnable entry point) #4984
Description
Finding
The C2 holepunch NAT-emulation lab exists and works, but it cannot be reproduced from the repo: it is bound to one machine's absolute paths.
doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/Cargo.toml:14— path dependency on/home/user/work/spikes/c1-connect..../spikes/c2-holepunch/lab/run.sh:24-26— hardcodes nix-store paths for thenft,iroh-relayandc2-holepunchbinaries..../spikes/c2-holepunch/lab/probe-nat.sh:14— hardcodesnftagain.- No flake app, just recipe, script or CI job runs the matrix: the lab is only reachable by hand from the author's checkout.
Why it matters
This is the second deliverable of #1826 (Drew's 2026-10-28 ruling: emulated laptop NAT is acceptable for the C2 cells a phone cannot cover, provided results are recorded as emulated). The emulation already covers the full matrix, including mixed pairs (.../c2-holepunch/RESULTS.md:96-123), and RESULTS.md:170 records that real NAT devices and real networks remain untested. What is missing is reproducibility: on a clean checkout today the matrix cannot be re-run or re-verified by anyone else.
What's needed
- Make
c1-connectresolvable relatively (workspace member or relative path), not an absolute/home/user/work/...path. - Resolve
nft,iroh-relayandc2-holepunchat runtime — anix develop/flake app that provides them, or env vars with a clear error when unset. - One documented entry point (flake app or just recipe) that runs
probe-nat.sh+ the full C2 matrix and writes a timestamped results file under the spike directory. - Stay netns-only (
unshare -Urn): no host network changes, no root requirement beyond user namespaces.
Acceptance criteria
- On a clean checkout, one documented command builds and runs the probe + matrix without editing any absolute path.
- The run writes a timestamped results artifact that states the NAT types are Linux netfilter emulation, not real NAT devices.
- The reproducer is exercised at least once end-to-end on the laptop, with the command and output recorded on this issue.
- Results are posted to id phase-3: P3.7 real-network holepunch and n0 QAD tests on two networks are owner-blocked with no tracking issue #795 labelled emulated (not real-network), and P3.7 test access: browser/Wasm peer page for phone runs + laptop VM NAT emulation #1826's second acceptance criterion is checked.
Filed by the #1826 triage (queue task 7751) as the split of its actionable half.
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Medium: expected under 1 day of workTest coverage, test infrastructure, or test-only fixesIntake review done: acceptance criteria, links, and normalized labels addedOrdinary priority (the default)Filed by the new-issue-creator jobQueue packet kind: bounded fix with reproduction and targeted tests
Activity
developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8144 (small_fix, queued, priority 40) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
76 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: picked-up
queue: repo-health-code-pilot
task: 8144 (small_fix, worker repo-worker-code, lane 262eb403-3347-4a7c-ba6b-e7bc263ca853)
by: openchamber-scheduled-lane
at: 2026-11-04T22:03:00Z
Claimed task 8144 via atomic queue claim and resumed its preserved implementation. Fresh GitHub checks: #4984 OPEN with no hard-stop labels and no PR found; #1826 and #795 remain open. First checkpoint records origin=openchamber-scheduled-lane and preserves branch queue/8144-4984-c2-nat-repro in /home/user/git/fleet/8144/repo. Next: inspect/reconcile worktree against current main, then complete targeted Nix/netns validation or park with a precise resume condition.
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: done
queue: repo-health-code-pilot
task: 8144 (small_fix, worker repo-worker-code, lane 262eb403-3347-4a7c-ba6b-e7bc263ca853)
by: openchamber-scheduled-lane
at: 2026-11-04T22:27:10Z
outcome: PR opened as #5665; queue task completed as pr_opened.
verified: fresh GitHub check shows #5665 OPEN on queue/8144-4984-c2-nat-repro; #4984 remains OPEN.
tests: documented Nix entry point passed: 3 NAT probes, 9/9 emulated matrix cells, all dial exit 0. CI was not yet reported at PR verification.
bookkeeping: sandbox backlog and sweep.log deferred to fleet reconciliation; completion result records backlog_updated=false.
dezren39 commentedon Nov 4, 2026
C2 reproducer run on 2026-11-04 (Linux netfilter emulation only; not real NAT devices or real-network measurements).
Command from the repository root:
C2_WINDOW=8 nix --extra-experimental-features "nix-command flakes" run ./doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch#c2-labSummary: all 3 NAT-behaviour probes completed; all 9 ordered NAT pairs completed with dial exit 0. The timestamped local report is
doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/results/20261104T222140Z-emulated-c2-matrix.md(the repository ignores generatedresults*files); its summary is reproduced on #795. Implementation PR: #5665.